如何从 JAX-WS Webservice 中的编程授权检查返回正确的 HTTP 状态代码？

Question

I have a Webservice like the following simplified example deployed on JBoss EAP 6 (JBoss AS 7):

@Stateless
@RolesAllowed("basic_role")
@WebService(name = "MyWebService", serviceName = "MyWebService")
@WebContext(contextRoot = "api", urlPattern = "/MyWebService", authMethod = "BASIC")
public class MyWebService {

    @Resource
    private WebServiceContext webServiceContext;

    @WebMethod
    public void doSomething(String parameter) {
        System.out.println(webServiceContext.getUserPrincipal());
        if (!webServiceContext.isUserInRole("role_for_parameter_" + parameter)) {
            throw new HTTPException(401);
        }
    }
}

I want to do a permission check based on the parameter passed in, but I do not know how to properly return a 401 status code. If the caller does not provide any credentials or the provided user does not have the "basic_role", the server returns 401 as expected. But once my code is called, if I throw any kind of exception, a status code 500 is returned. I thought this was what the HTTPException was for, but it makes no difference if I use HTTPException or RuntimeException or any other Exception I tried.

The only way I could come up with is this:

@WebMethod
public void doSomething(String parameter) {
    System.out.println(webServiceContext.getUserPrincipal());
    if (!webServiceContext.isUserInRole("role_for_parameter_" + parameter)) {
        HttpServletResponse response = (HttpServletResponse)webServiceContext.getMessageContext().get(MessageContext.SERVLET_RESPONSE);
        try {
            response.sendError(401, "Not authorized");
            throw new RuntimeException("Not authorized");
        }
        catch (IOException e) {
            throw propagate(e);
        }
    }
}

This way, the 401 status code is returned, but I need to throw the exception as well to prevent further processing, and it seems from the logs that JAX-WS tries to return a 500 with the RuntimeException, only it can't because the response is already commited. This doesn't seem to be a clean way to do it.

Answer 1

Not sure it's the best method, but works for me:

webServiceContext.getMessageContext()
     .put(MessageContext.HTTP_RESPONSE_CODE, HttpStatus.UNAUTHORIZED_401);
return;